DevOps platform Northflank has disclosed a security incident involving unauthorized activity using AI API keys. The company has urged all customers to rotate every platform secret—environmental variables, shared secrets, and global settings—following evidence that these credentials may have been exposed. While it has yet to identify a confirmed entry method or affected accounts, Northflank stresses these measures as precautionary.
What Happened & How Northflank Responded
The chain of events began October 30, 2026, when a Wiz alert flagged a potential threat at 11:43 UTC. Within one minute, Northflank engineers began a review. Patches to network policies followed—first at 12:02, then at 12:50 and 13:05 UTC. At 13:00 UTC, the platform sought assistance from Wiz’s incident response team. Still, Northflank has not detailed what exactly those initial patches addressed or how an attacker might have penetrated defenses.
Why Customers Must Assume Exposure
Northflank warns users to treat all environment variables as compromised, since they may contain sensitive information such as API keys, database passwords, or other application credentials. The company also recommends restricting public access to add-ons to limit risk. This move follows similar incidents at other dev platform providers, where environment variables were the entry point for misuse.
The incident ties into a wider trend. Wiz’s “Black October” report highlighted attacks impacting at least nine AI development platforms during October. These attacks often share patterns—misuse of stored environment variables—but no single vulnerability has been pinned down. One major risk is LLMjacking, where stolen credentials are used to run paid AI services under the victim’s account. Northflank has not confirmed financial or usage losses or a centralized resale operation.
What Northflank is Doing & What Customers Must Do
To address the breach, Northflank has enabled secret rotation for popular add-ons, including PostgreSQL, MongoDB, MySQL, Redis, MinIO, and RabbitMQ. Audit logging is now available to all users—even those on free plans—so everyone can track usage and check for anomalies.
Customers are strongly urged to revoke credentials through the original providers, generate new ones, and update any secrets or environment variables in Northflank. They should also audit their billing and AI usage for unexpected activity and report anything suspicious to both Northflank support and the respective key providers.
Northflank emphasizes that while it hasn’t fully confirmed which accounts may be impacted, nor how an attacker gained access, its guidance remains in effect until the investigation concludes.
Analysis: This incident spotlights a recurring weakness in cloud-native and AI-facing platforms: storage of secrets in environment variables without tight access controls. As development platforms proliferate and AI integrations deepen, attackers increasingly target credentials as a way to monetize access quietly. Organizations using services like Northflank must treat secret management as a first-class security priority—regular rotation, minimal privilege, and full visibility. Going forward, platform providers should offer stricter built-in controls by default and transparent incident reporting so customers aren’t left making critical risk decisions in the dark.
